PT-2026-26657 · Unknown · Cryptomator

Yanchon918S · Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-32309

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Cryptomator versions prior to 1.19.1

Description Cryptomator encrypts data stored on cloud infrastructure. The Hub-based unlock flow, in versions before 1.19.1, allows the use of hub+http and retrieves Hub endpoints from vault metadata without requiring HTTPS. This can lead to OAuth and key-loading traffic being transmitted over insecure HTTP connections, potentially exposing bearer tokens and endpoint trust decisions to interception and tampering by a network attacker. The issue is related to the handling of Hub endpoints and the lack of HTTPS enforcement during the unlock process.

Recommendations Update to version 1.19.1 or later.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2026-32309

GHSA-VV33-H7QX-C264

Affected Products

Cryptomator

References · 6

• 🔥 https://github.com/cryptomator/cryptomator/security/advisories/GHSA-vv33-h7qx-c264 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32309.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32309 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32309 · Vendor Advisory
• https://github.com/cryptomator/cryptomator/releases/tag/1.19.1 · Note
• https://twitter.com/CVEnew/status/2035619780712100331 · Twitter Post